How a catch-all rule silently kills everything after it

Because iptables stops at the first matching rule in a chain, a rule with no match conditions at all — no protocol, no source, no port, nothing — matches every single packet that reaches it, which means every rule listed after it in that chain becomes permanently unreachable regardless of how specific or well-written those later rules are. This is an easy mistake to make by accident: a broad `-j ACCEPT` added early for quick testing and never removed, sitting above a carefully built-out set of specific rules that now do nothing. This tool flags exactly that shape specifically because it's both common and completely silent — nothing about a `iptables -L` listing visually signals that half the rules below a catch-all will never fire.

Why this deliberately checks exact matches only

Detecting every possible way one rule could partially shadow another — a /8 source range overlapping a later /32, an interface wildcard subsuming a specific interface name — requires genuine constraint-solving logic comparable to a real firewall policy analyzer, which is a much bigger and more error-prone undertaking than this tool aims for. Sticking to exact catch-all detection and byte-for-byte duplicate detection means every finding this tool reports is unambiguous and verifiably correct, at the cost of not catching subtler partial-overlap cases. A clean result here means "no obvious dead rules were found," not a formal guarantee that the rule set has no shadowing anywhere — that distinction is called out directly in the tool's own guide for exactly this reason.